Symantec: Data breaches are becoming a headache for business IT departments and it is now necessary for all staff to be constantly alert to security issues.
But while businesses focus their efforts on deterring would-be attackers, it is important to also have a strategy for dealing with a breach, should it occur.
The first few days and weeks after a breach are critical and emotionally charged. Businesses often react impulsively and start downloading logs, taking servers offline, and rushing to repair the damage, unaware that doing so could destroy important evidence. The truth is that these measures can hinder investigations and cause bigger problems. It is important for businesses to know what to do in the event of a breach, implement best practices, and have a breach response manual in place.
One of the most important steps to take from the start is to have a clear process for informing IT of any security issues that have arisen in the business. Most of the time, security breaches go unnoticed by the business itself. They are usually discovered by compliance departments, trading partners such as payment processors, or even customers, and do not quickly reach the CIO’s office because the person receiving the information usually does not know where to turn.
1 day to 1 week after the breach:
Once the Chief Information Officer (CIO), Chief Information Security Officer (CISO), and IT staff are notified of the breach, the CISO should follow a three-pronged process: Direct IT to preserve evidence and assess both the size and scope of the breach, work with the legal department to decide what should be disclosed, and inform the CIO and CEO of developments so they can in turn inform shareholders of the situation.
